tribunal-kit 9.2.4 → 9.2.6

package/.agents/skills/devops-engineer/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: devops-engineer
-description: "Use when DevOps engineering mastery. Docker containerization, Docker Compose, CI/CD with GitHub Actions, Kubernetes basics, infrastructure as code (Terraform), monitoring/alerting, deployment strategies (blue/green, canary, rolling), secrets management, and production readiness checklists. Use when building CI/CD pipelines, containerizing apps, or managing infrastructure."
-version: 5.0.0
-last-updated: 2026-09-13
+description: "Use when configuring, automating, deploying, and debugging devops engineer pipelines, containers, servers, and cloud infrastructure."
+version: 6.0.0
+last-updated: 2026-09-29
 skills:
   - cicd-pro
   - containerization-pro
@@ -15,291 +15,361 @@ scripts-binding:
 
 # DevOps Engineer — CI/CD & Infrastructure Mastery
 
----
-
-## 🛠️ Technical Architecture & Reference Recipes
-
----
-
----
-
-## Docker
-
-### Dockerfile (Production-Ready)
-
-```dockerfile
-# ✅ Multi-stage build — minimal final image
-FROM node:22-alpine AS builder
-WORKDIR /app
-
-# Install deps first (cache layer)
-COPY package.json package-lock.json ./
-RUN npm ci --ignore-scripts
-
-# Build
-COPY . .
-RUN npm run build
-
-# ──── Production stage ────
-FROM node:22-alpine AS runner
-WORKDIR /app
-
-# Security: non-root user
-RUN addgroup --system --gid 1001 appgroup && \
-    adduser --system --uid 1001 appuser
-
-# Copy only production artifacts
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/package.json ./
-
-USER appuser
-EXPOSE 3000
-ENV NODE_ENV=production
-
-HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
-  CMD wget --quiet --tries=1 --spider http://localhost:3000/health || exit 1
-
-CMD ["node", "dist/index.js"]
-```
-
-```dockerfile
-# ❌ HALLUCINATION TRAP: Common Dockerfile mistakes
-# ❌ FROM node:22         ← 1GB+ image (use alpine: ~150MB)
-# ❌ RUN npm install      ← installs devDependencies, no lockfile
-# ✅ RUN npm ci           ← deterministic, production-only
-# ❌ COPY . .             ← copies node_modules, .git, secrets
-# ✅ Use .dockerignore     ← exclude node_modules, .env, .git
-# ❌ Running as root      ← security vulnerability
-# ✅ USER appuser          ← non-root user
-```
-
-### .dockerignore
-
-```
-node_modules
-.git
-.env
-.env.*
-*.md
-.github
-coverage
-dist
-```
-
-### Docker Compose
-
-```yaml
-# docker-compose.yml
-services:
-  app:
-    build:
-      context: .
-      target: runner
-    ports:
-      - '3000:3000'
-    environment:
-      - DATABASE_URL=postgres://postgres:postgres@db:5432/myapp
-      - REDIS_URL=redis://redis:6379
-    depends_on:
-      db:
-        condition: service_healthy
-      redis:
-        condition: service_started
-    restart: unless-stopped
+## Mandatory Pre-Flight Context Inspection
+Before reading, generating, or refactoring code in the `devops-engineer` domain, inspect these 5 critical parameters:
+1. **System Boundaries & Dependencies**: Verify that all required dependencies exist in target package manifests and environment paths.
+2. **Runtime Context & Platform Invariants**: Confirm target platform constraints (Node.js, Browser, Mobile OS, Edge runtime) before applying APIs.
+3. **Execution Guardrails**: Identify potential side-effects, state mutations, and unhandled asynchronous exceptions.
+4. **Validation & Type Contracts**: Validate input data schemas and strict type constraints across all module interfaces.
+5. **Observability & Proof of Execution**: Ensure execution produces tangible verification signals (terminal output, tests, metrics).
 
-  db:
-    image: postgres:16-alpine
-    environment:
-      POSTGRES_DB: myapp
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U postgres']
-      interval: 5s
-      timeout: 3s
-      retries: 5
 
-  redis:
-    image: redis:7-alpine
-    volumes:
-      - redisdata:/data
+## Activation Boundaries
+- **Activate when:** Use when configuring, automating, deploying, and debugging devops engineer pipelines, containers, servers, and cloud infrastructure.
+- **DO NOT activate when:** The task falls outside the `devops-engineer` domain or is managed by a different dedicated specialist agent.
 
-volumes:
-  pgdata:
-  redisdata:
-```
-
----
-
-## CI/CD with GitHub Actions
-
-### Standard Pipeline
-
-```yaml
-# .github/workflows/ci.yml
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true # cancel stale runs on same PR
+## 🔁 Multi-Pass Execution Protocol
 
-jobs:
-  lint-and-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
+| Pass | Phase | Core Action | Adaptive Depth |
+|:---|:---|:---|:---|
+| **Pass 1** | **Understand** | Deconstruct the user's explicit objective, implicit requirements, and platform constraints. | Fast / Standard / Deep |
+| **Pass 2** | **Plan** | Decompose task into smallest logical steps; map dependencies, affected files, and tool calls. | Standard / Deep |
+| **Pass 3** | **Execute** | Implement solution with production-grade craft, zero placeholders, and strict typing. | All Modes |
+| **Pass 4** | **Verify** | Run linters, unit tests, or compiler checks to validate structural correctness. | All Modes |
+| **Pass 5** | **Attack & Falsify** | Perform adversarial search for edge-case failures, counterexamples, race conditions, and traps. | Standard / Deep |
+| **Pass 6** | **Harden** | Eliminate discovered friction, optimize performance, and harden error boundaries. | Standard / Deep |
+| **Pass 7** | **Quality Gate** | Enforce Verification-Before-Completion (VBC) with concrete terminal proof before finalizing. | All Modes |
 
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
 
-      - run: npm ci
-      - run: npm run lint
-      - run: npm run typecheck
-      - run: npm run test -- --coverage
-
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: coverage
-          path: coverage/
-
-  build:
-    runs-on: ubuntu-latest
-    needs: lint-and-test
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run build
-
-  deploy:
-    runs-on: ubuntu-latest
-    needs: build
-    if: github.ref == 'refs/heads/main'
-    environment: production
-    steps:
-      - uses: actions/checkout@v4
+---
+
+## 🛠️ Technical Architecture & Reference Recipes
 
-      # Deploy to your platform (Vercel, Railway, Fly.io, etc.)
-      - run: npx vercel deploy --prod --token=${{ secrets.VERCEL_TOKEN }}
+---
+
+## Docker
+
+### Dockerfile (Production-Ready)
+
+```dockerfile
+# ✅ Multi-stage build — minimal final image
+FROM node:22-alpine AS builder
+WORKDIR /app
+
+# Install deps first (cache layer)
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts
+
+# Build
+COPY . .
+RUN npm run build
+
+# ──── Production stage ────
+FROM node:22-alpine AS runner
+WORKDIR /app
+
+# Security: non-root user
+RUN addgroup --system --gid 1001 appgroup && \
+    adduser --system --uid 1001 appuser
+
+# Copy only production artifacts
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./
+
+USER appuser
+EXPOSE 3000
+ENV NODE_ENV=production
+
+HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
+  CMD wget --quiet --tries=1 --spider http://localhost:3000/health || exit 1
+
+CMD ["node", "src/index.js"]
+```
+
+```dockerfile
+# ❌ HALLUCINATION TRAP: Common Dockerfile mistakes
+# ❌ FROM node:22         ← 1GB+ image (use alpine: ~150MB)
+# ❌ RUN npm install      ← installs devDependencies, no lockfile
+# ✅ RUN npm ci           ← deterministic, production-only
+# ❌ COPY . .             ← copies node_modules, .git, secrets
+# ✅ Use .dockerignore     ← exclude node_modules, .env, .git
+# ❌ Running as root      ← security vulnerability
+# ✅ USER appuser          ← non-root user
+```
+
+### .dockerignore
+
+```
+node_modules
+.git
+.env
+.env.*
+*.md
+.github
+coverage
+dist
+```
+
+### Docker Compose
+
+```yaml
+# docker-compose.yml
+services:
+  app:
+    build:
+      context: .
+      target: runner
+    ports:
+      - '3000:3000'
+    environment:
+      - DATABASE_URL=postgres://postgres:postgres@db:5432/myapp
+      - REDIS_URL=redis://redis:6379
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    restart: unless-stopped
+
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: myapp
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U postgres']
+      interval: 5s
+      timeout: 3s
+      retries: 5
+
+  redis:
+    image: redis:7-alpine
+    volumes:
+      - redisdata:/data
+
+volumes:
+  pgdata:
+  redisdata:
+```
+
+---
+
+## CI/CD with GitHub Actions
+
+### Standard Pipeline
+
+```yaml
+# .github/workflows/ci.yml
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true # cancel stale runs on same PR
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run test -- --coverage
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: coverage
+          path: coverage/
+
+  build:
+    runs-on: ubuntu-latest
+    needs: lint-and-test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main'
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+
+      # Deploy to your platform (Vercel, Railway, Fly.io, etc.)
+      - run: npx vercel deploy --prod --token=${{ secrets.VERCEL_TOKEN }}
+```
+
+### Security Scanning
+
+```yaml
+security:
+  runs-on: ubuntu-latest
+  steps:
+    - uses: actions/checkout@v4
+    - run: npm audit --audit-level=high
+    - uses: github/codeql-action/analyze@v3
+      with:
+        languages: javascript-typescript
+```
+
+---
+
+## Deployment Strategies
+
+```
+Rolling Update (default):
+  Old ████████ → ██████░░ → ████░░░░ → ░░░░░░░░
+  New ░░░░░░░░ → ░░██████ → ░░░░████ → ████████
+  - Gradual replacement, zero downtime
+  - Rollback: redeploy previous version
+
+Blue/Green:
+  Blue  ████████ (live)     → ░░░░░░░░ (idle)
+  Green ░░░░░░░░ (staging)  → ████████ (live)
+  - Instant switch via load balancer
+  - Instant rollback (switch back)
+  - Requires 2x infrastructure
+
+Canary:
+  Stable ████████ (95%)  → ████████ (90%)  → ████████ (0%)
+  Canary ░░░░░░░░ (5%)   → ░░░░░░░░ (10%)  → ████████ (100%)
+  - Gradual traffic shift
+  - Monitor error rates/latency at each stage
+  - Rollback: stop canary traffic
+
+Feature Flags:
+  - Deploy code, control activation separately
+  - Risk-free deploys — flag is off by default
+  - A/B testing capability
+```
+
+---
+
+## Secrets Management
+
+```yaml
+# ❌ NEVER:
+# - Hardcode secrets in code
+# - Commit .env files to git
+# - Use plain text in CI/CD configs
+# - Share secrets via Slack/email
+
+# ✅ ALWAYS:
+# GitHub Actions: Repository Secrets
+# - Settings → Secrets → Actions → New repository secret
+# - Reference: ${{ secrets.MY_SECRET }}
+
+# Production: Use your platform's secret manager
+# - AWS Secrets Manager / SSM Parameter Store
+# - GCP Secret Manager
+# - Azure Key Vault
+# - Doppler / Infisical (cross-platform)
+
+# .env management:
+# .env          → git-ignored, local development
+# .env.example  → committed, shows required keys (no values)
+```
+
+---
+
+## Production Readiness Checklist
+
+```
+Pre-Deploy:
+  □ All tests passing (unit, integration, E2E)
+  □ Security scan clean (npm audit, CodeQL)
+  □ Build succeeds in CI (not just locally)
+  □ Database migrations tested against production-size data
+  □ Environment variables verified in target environment
+  □ Rollback plan documented
+
+Monitoring:
+  □ Health check endpoint (/health)
+  □ Structured logging (JSON, not console.log)
+  □ Error tracking (Sentry, Datadog)
+  □ Uptime monitoring (external)
+  □ Alerting configured (PagerDuty, OpsGenie)
+
+Performance:
+  □ Response time P95 < 500ms
+  □ Error rate < 0.1%
+  □ Database connection pooling configured
+  □ CDN for static assets
+  □ Compression enabled (gzip/brotli)
+
+Security:
+  □ HTTPS only (HSTS enabled)
+  □ Rate limiting on all public endpoints
+  □ CORS configured (not wildcard *)
+  □ Security headers (helmet)
+  □ No secrets in code or logs
 ```
 
-### Security Scanning
+## 🚨 Edge-Case & Failure Mode Matrix
 
-```yaml
-security:
-  runs-on: ubuntu-latest
-  steps:
-    - uses: actions/checkout@v4
-    - run: npm audit --audit-level=high
-    - uses: github/codeql-action/analyze@v3
-      with:
-        languages: javascript-typescript
-```
+| Scenario | Risk | Production Mitigation |
+|:---|:---|:---|
+| **Empty or Null Inputs** | Unhandled exception or unexpected rendering collapse | Enforce fallback guards, optional chaining, and explicit empty state handlers |
+| **Network Timeout / Latency** | Hanging operations or duplicate side-effects | Implement bounded abort controllers, exponential backoff, and idempotency keys |
+| **Concurrency / Race Conditions** | Stale state overwrite or inconsistent data mutations | Use atomic transactions, mutex locking, or cancel-on-resubmit controls |
+| **Invalid Schema / Malformed Payload** | Downstream runtime errors or security injection | Validate boundary payloads with Zod/Pydantic schemas prior to execution |
+| **Resource / Memory Saturation** | OOM errors, frame drops, or memory leaks | Clean up listeners, cancel active timers, and enforce pagination/virtualization |
 
----
 
-## Deployment Strategies
+## 🤖 LLM-Specific Traps Table
 
-```
-Rolling Update (default):
-  Old ████████ → ██████░░ → ████░░░░ → ░░░░░░░░
-  New ░░░░░░░░ → ░░██████ → ░░░░████ → ████████
-  - Gradual replacement, zero downtime
-  - Rollback: redeploy previous version
+| Anti-Pattern | What AI Commonly Does Wrong | What Is Actually Correct |
+|:---|:---|:---|
+| **Silent Pipeline Failure** | Executing shell steps without set -euo pipefail, ignoring errors | Always initialize shell scripts with set -euo pipefail and trap handlers |
+| **Unpinned Dependency Shift** | Installing packages with npm install or using :latest docker tags | Lock dependencies with npm ci / lockfiles and use immutable SHA256 image digests |
+| **Leaking Build Secrets** | Passing secrets as Docker build arguments baked into image layers | Use Docker BuildKit secret mounts (--mount=type=secret) or runtime injection |
 
-Blue/Green:
-  Blue  ████████ (live)     → ░░░░░░░░ (idle)
-  Green ░░░░░░░░ (staging)  → ████████ (live)
-  - Instant switch via load balancer
-  - Instant rollback (switch back)
-  - Requires 2x infrastructure
 
-Canary:
-  Stable ████████ (95%)  → ████████ (90%)  → ████████ (0%)
-  Canary ░░░░░░░░ (5%)   → ░░░░░░░░ (10%)  → ████████ (100%)
-  - Gradual traffic shift
-  - Monitor error rates/latency at each stage
-  - Rollback: stop canary traffic
+## 🏛️ Tribunal Verification & Guardrails
 
-Feature Flags:
-  - Deploy code, control activation separately
-  - Risk-free deploys — flag is off by default
-  - A/B testing capability
-```
-
----
-
-## Secrets Management
+**Active Reviewers:** `pipeline-reviewer` · `devops-engineer` · `resilience-reviewer`
+**Slash Command:** `/review` or `/tribunal-full`
 
-```yaml
-# ❌ NEVER:
-# - Hardcode secrets in code
-# - Commit .env files to git
-# - Use plain text in CI/CD configs
-# - Share secrets via Slack/email
+### 🔬 Evidence Standard (Tri-State Verification)
+Every finding, audit statement, or completion claim must classify its factual certainty:
+- **`[OBSERVED]`**: Directly confirmed in the codebase or verified via executed terminal command.
+- **`[INFERRED]`**: Logically deduced from code patterns, architectural data flow, or schema relations.
+- **`[UNVERIFIED]`**: Speculative hypothesis or runtime possibility requiring active testing or measurement.
 
-# ✅ ALWAYS:
-# GitHub Actions: Repository Secrets
-# - Settings → Secrets → Actions → New repository secret
-# - Reference: ${{ secrets.MY_SECRET }}
-
-# Production: Use your platform's secret manager
-# - AWS Secrets Manager / SSM Parameter Store
-# - GCP Secret Manager
-# - Azure Key Vault
-# - Doppler / Infisical (cross-platform)
-
-# .env management:
-# .env          → git-ignored, local development
-# .env.example  → committed, shows required keys (no values)
+### ✅ Pre-Flight Self-Audit Checklist
 ```
-
----
-
-## Production Readiness Checklist
-
+✅ Are strict execution modes (set -euo pipefail) active on all scripts?
+✅ Are container images pinned to immutable digest/SHA tags instead of "latest"?
+✅ Are deployment health checks, liveness probes, and rollback baselines configured?
+✅ Are CI secrets masked and unexposed to untrusted pull requests?
+✅ Did I verify environment compatibility across target runtimes?
 ```
-Pre-Deploy:
-  □ All tests passing (unit, integration, E2E)
-  □ Security scan clean (npm audit, CodeQL)
-  □ Build succeeds in CI (not just locally)
-  □ Database migrations tested against production-size data
-  □ Environment variables verified in target environment
-  □ Rollback plan documented
 
-Monitoring:
-  □ Health check endpoint (/health)
-  □ Structured logging (JSON, not console.log)
-  □ Error tracking (Sentry, Datadog)
-  □ Uptime monitoring (external)
-  □ Alerting configured (PagerDuty, OpsGenie)
-
-Performance:
-  □ Response time P95 < 500ms
-  □ Error rate < 0.1%
-  □ Database connection pooling configured
-  □ CDN for static assets
-  □ Compression enabled (gzip/brotli)
-
-Security:
-  □ HTTPS only (HSTS enabled)
-  □ Rate limiting on all public endpoints
-  □ CORS configured (not wildcard *)
-  □ Security headers (helmet)
-  □ No secrets in code or logs
-```
+### 🛑 Verification-Before-Completion (VBC) Protocol
+**CRITICAL:** You must follow a strict "evidence-based closeout" state machine.
+- ❌ **Forbidden:** Declaring a task complete because the output "looks correct."
+- ✅ **Required:** You are explicitly forbidden from finalizing any task without providing **concrete evidence** (terminal output, passing test suites, compiler success, or equivalent operational proof) that your output works as intended.